{"id":16862,"date":"2015-03-03T12:24:32","date_gmt":"2015-03-03T18:24:32","guid":{"rendered":"https:\/\/secure.rosehosting.com\/blog\/?p=16862"},"modified":"2022-06-03T03:46:20","modified_gmt":"2022-06-03T08:46:20","slug":"install-fail2ban-on-an-ubuntu-14-04","status":"publish","type":"post","link":"https:\/\/www.rosehosting.com\/blog\/install-fail2ban-on-an-ubuntu-14-04\/","title":{"rendered":"Install Fail2ban on an Ubuntu 14.04 VPS"},"content":{"rendered":"
<\/div>

\"install-fail2ban-on-an-ubuntu-14-04\"In this tutorial, we will explain how to install Fail2ban on an Ubuntu 14.04 VPS. Fail2Ban is a Python application that monitors log files to detect potential intrusion attempts. Fail2ban scans the log files looking for specific patterns that indicate an attack. It uses iptables to block IPs that show the malicious signs such as brute-force attempts on SSH, HTTP, FTP, SMTP ..etc. This guide should work on other Linux VPS<\/a> systems as well but was tested and written for Ubuntu 14.04 VPS<\/a>.<\/p>\n

 <\/p>\n

<\/p>\n

Install fail2ban<\/h4>\n

As always, first login to your VPS via SSH:<\/p>\n

# ssh user@hostname<\/pre>\n
Installing Fail2ban is very simple just run:<\/p>\n
user@hostname ~$ sudo apt-get update\r\nuser@hostname ~$ sudo apt-get install fail2ban<\/pre>\n
If you want Fail2ban to send mail notifications, you’ll need some kind of SMTP server such as Posfix, Exim or Sendmail. For example, you can install Posfix with the following command:<\/p>\n
user@hostname ~$ sudo apt-get install postfix<\/pre>\n
Configure fail2ban<\/h4>\n
The best practice is to duplicate the default Fail2ban configuration file and to work on a local copy, which keeps your changes safe from updates. To create a local copy (jail.local) just run:<\/p>\n
user@hostname ~$ sudo cp \/etc\/fail2ban\/jail.conf \/etc\/fail2ban\/jail.local<\/pre>\n
After the file is copied, you should make all your changes and additions to the jail.local file.<\/p>\n
Open up the jail.local file in your text editor of choice and let’s make some changes.<\/p>\n
user@hostname ~$ sudo vim \/etc\/fail2ban\/jail.local<\/pre>\n
The [DEFAULT] section:<\/p>\n